Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Detection Rules] Add 7.15 rules #111464

Merged
merged 2 commits into from
Sep 8, 2021
Merged

[Detection Rules] Add 7.15 rules #111464

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8f71fa9
[Detection Rules] Add 7.15 rules
brokensound77 Sep 7, 2021
1e9d943
Merge branch 'master' into detection-rules/7.15-14660994d2a
kibanamachine Sep 8, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions ...e/rules/prepackaged_rules/defense_evasion_privacy_controls_tcc_database_modification.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"query": "process where event.type in (\"start\", \"process_started\") and process.name : \"sqlite*\" and \n process.args : \"/*/Application Support/com.apple.TCC/TCC.db\"\n",
"references": [
"https://applehelpwriter.com/2016/08/29/discovering-how-dropbox-hacks-your-mac/",
"https://github.com/bp88/JSS-Scripts/blob/master/TCC.db Modifier.sh",
"https://github.com/bp88/JSS-Scripts/blob/master/TCC.db%20Modifier.sh",
"https://medium.com/@mattshockl/cve-2020-9934-bypassing-the-os-x-transparency-consent-and-control-tcc-framework-for-4e14806f1de8"
],
"risk_score": 47,
Expand Down Expand Up @@ -53,5 +53,5 @@
],
"timestamp_override": "event.ingested",
"type": "eql",
"version": 1
"version": 2
}
4 changes: 2 additions & 2 deletions ...lution/server/lib/detection_engine/rules/prepackaged_rules/elastic_endpoint_security.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
"license": "Elastic License v2",
"max_signals": 10000,
"name": "Endpoint Security",
"query": "event.kind:alert and event.module:(endpoint and not endgame) and not event.code: behavior\n",
"query": "event.kind:alert and event.module:(endpoint and not endgame)\n",
"risk_score": 47,
"risk_score_mapping": [
{
Expand Down Expand Up @@ -64,5 +64,5 @@
],
"timestamp_override": "event.ingested",
"type": "query",
"version": 4
"version": 3
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is okay, because this v4 of the rule has never made it in a released stack

}
68 changes: 0 additions & 68 deletions ...tection_engine/rules/prepackaged_rules/elastic_endpoint_security_behavior_protection.json
View file
Open in desktop

This file was deleted.

4 changes: 1 addition & 3 deletions ...ck/plugins/security_solution/server/lib/detection_engine/rules/prepackaged_rules/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -580,8 +580,7 @@ import rule567 from './defense_evasion_parent_process_pid_spoofing.json';
import rule568 from './defense_evasion_defender_exclusion_via_powershell.json';
import rule569 from './defense_evasion_whitespace_padding_in_command_line.json';
import rule570 from './persistence_webshell_detection.json';
import rule571 from './elastic_endpoint_security_behavior_protection.json';
import rule572 from './persistence_via_bits_job_notify_command.json';
import rule571 from './persistence_via_bits_job_notify_command.json';

export const rawRules = [
rule1,
Expand Down Expand Up @@ -1155,5 +1154,4 @@ export const rawRules = [
rule569,
rule570,
rule571,
rule572,
];
4 changes: 2 additions & 2 deletions ...ngine/rules/prepackaged_rules/initial_access_azure_active_directory_high_risk_signin.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
"license": "Elastic License v2",
"name": "Azure Active Directory High Risk Sign-in",
"note": "## Config\n\nThe Azure Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.",
"query": "event.dataset:azure.signinlogs and\n azure.signinlogs.properties.risk_level_during_signin:high and\n event.outcome:(success or Success)\n",
"query": "event.dataset:azure.signinlogs and\n (azure.signinlogs.properties.risk_level_during_signin:high or azure.signinlogs.properties.risk_level_aggregated:high) and\n event.outcome:(success or Success)\n",
"references": [
"https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-risk",
"https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection",
Expand Down Expand Up @@ -49,5 +49,5 @@
],
"timestamp_override": "event.ingested",
"type": "query",
"version": 2
"version": 3
}
5 changes: 1 addition & 4 deletions .../detection_engine/rules/prepackaged_rules/ml_linux_anomalous_kernel_module_arguments.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,6 @@
"license": "Elastic License v2",
"machine_learning_job_id": "linux_rare_kernel_module_arguments",
"name": "Anomalous Kernel Module Activity",
"references": [
"references"
],
"risk_score": 21,
"rule_id": "37b0816d-af40-40b4-885f-bb162b3c88a9",
"severity": "low",
Expand Down Expand Up @@ -50,5 +47,5 @@
}
],
"type": "machine_learning",
"version": 3
"version": 4
}
4 changes: 2 additions & 2 deletions ...ction_engine/rules/prepackaged_rules/persistence_docker_shortcuts_plist_modification.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
"name": "Persistence via Docker Shortcut Modification",
"query": "event.category : file and event.action : modification and \n file.path : /Users/*/Library/Preferences/com.apple.dock.plist and \n not process.name : (xpcproxy or cfprefsd or plutil or jamf or PlistBuddy or InstallerRemotePluginService)\n",
"references": [
"https://github.com/specterops/presentations/raw/master/Leo Pitt/Hey_Im_Still_in_Here_Modern_macOS_Persistence_SO-CON2020.pdf"
"https://github.com/specterops/presentations/raw/master/Leo%20Pitt/Hey_Im_Still_in_Here_Modern_macOS_Persistence_SO-CON2020.pdf"
],
"risk_score": 47,
"rule_id": "c81cefcb-82b9-4408-a533-3c3df549e62d",
Expand Down Expand Up @@ -44,5 +44,5 @@
],
"timestamp_override": "event.ingested",
"type": "query",
"version": 1
"version": 2
}
4 changes: 2 additions & 2 deletions ...ib/detection_engine/rules/prepackaged_rules/persistence_finder_sync_plugin_pluginkit.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
"name": "Finder Sync Plugin Registered and Enabled",
"query": "sequence by host.id, user.id with maxspan = 5s\n [process where event.type in (\"start\", \"process_started\") and process.name : \"pluginkit\" and process.args : \"-a\"]\n [process where event.type in (\"start\", \"process_started\") and process.name : \"pluginkit\" and\n process.args : \"-e\" and process.args : \"use\" and process.args : \"-i\" and\n not process.args :\n (\n \"com.google.GoogleDrive.FinderSyncAPIExtension\",\n \"com.google.drivefs.findersync\",\n \"com.boxcryptor.osx.Rednif\",\n \"com.adobe.accmac.ACCFinderSync\",\n \"com.microsoft.OneDrive.FinderSync\",\n \"com.insynchq.Insync.Insync-Finder-Integration\",\n \"com.box.desktop.findersyncext\"\n )\n ]\n",
"references": [
"https://github.com/specterops/presentations/raw/master/Leo Pitt/Hey_Im_Still_in_Here_Modern_macOS_Persistence_SO-CON2020.pdf"
"https://github.com/specterops/presentations/raw/master/Leo%20Pitt/Hey_Im_Still_in_Here_Modern_macOS_Persistence_SO-CON2020.pdf"
],
"risk_score": 47,
"rule_id": "37f638ea-909d-4f94-9248-edd21e4a9906",
Expand Down Expand Up @@ -46,5 +46,5 @@
}
],
"type": "eql",
"version": 1
"version": 2
}
4 changes: 2 additions & 2 deletions ...engine/rules/prepackaged_rules/privilege_escalation_unusual_parentchild_relationship.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"name": "Unusual Parent-Child Relationship",
"query": "process where event.type in (\"start\", \"process_started\") and\nprocess.parent.name != null and\n (\n /* suspicious parent processes */\n (process.name:\"autochk.exe\" and not process.parent.name:\"smss.exe\") or\n (process.name:(\"fontdrvhost.exe\", \"dwm.exe\") and not process.parent.name:(\"wininit.exe\", \"winlogon.exe\")) or\n (process.name:(\"consent.exe\", \"RuntimeBroker.exe\", \"TiWorker.exe\") and not process.parent.name:\"svchost.exe\") or\n (process.name:\"SearchIndexer.exe\" and not process.parent.name:\"services.exe\") or\n (process.name:\"SearchProtocolHost.exe\" and not process.parent.name:(\"SearchIndexer.exe\", \"dllhost.exe\")) or\n (process.name:\"dllhost.exe\" and not process.parent.name:(\"services.exe\", \"svchost.exe\")) or\n (process.name:\"smss.exe\" and not process.parent.name:(\"System\", \"smss.exe\")) or\n (process.name:\"csrss.exe\" and not process.parent.name:(\"smss.exe\", \"svchost.exe\")) or\n (process.name:\"wininit.exe\" and not process.parent.name:\"smss.exe\") or\n (process.name:\"winlogon.exe\" and not process.parent.name:\"smss.exe\") or\n (process.name:(\"lsass.exe\", \"LsaIso.exe\") and not process.parent.name:\"wininit.exe\") or\n (process.name:\"LogonUI.exe\" and not process.parent.name:(\"wininit.exe\", \"winlogon.exe\")) or\n (process.name:\"services.exe\" and not process.parent.name:\"wininit.exe\") or\n (process.name:\"svchost.exe\" and not process.parent.name:(\"MsMpEng.exe\", \"services.exe\")) or\n (process.name:\"spoolsv.exe\" and not process.parent.name:\"services.exe\") or\n (process.name:\"taskhost.exe\" and not process.parent.name:(\"services.exe\", \"svchost.exe\")) or\n (process.name:\"taskhostw.exe\" and not process.parent.name:(\"services.exe\", \"svchost.exe\")) or\n (process.name:\"userinit.exe\" and not process.parent.name:(\"dwm.exe\", \"winlogon.exe\")) or\n (process.name:(\"wmiprvse.exe\", \"wsmprovhost.exe\", \"winrshost.exe\") and not process.parent.name:\"svchost.exe\") or\n /* suspicious child processes */\n (process.parent.name:(\"SearchProtocolHost.exe\", \"taskhost.exe\", \"csrss.exe\") and not process.name:(\"werfault.exe\", \"wermgr.exe\", \"WerFaultSecure.exe\")) or\n (process.parent.name:\"autochk.exe\" and not process.name:(\"chkdsk.exe\", \"doskey.exe\", \"WerFault.exe\")) or\n (process.parent.name:\"smss.exe\" and not process.name:(\"autochk.exe\", \"smss.exe\", \"csrss.exe\", \"wininit.exe\", \"winlogon.exe\", \"setupcl.exe\", \"WerFault.exe\")) or\n (process.parent.name:\"wermgr.exe\" and not process.name:(\"WerFaultSecure.exe\", \"wermgr.exe\", \"WerFault.exe\")) or\n (process.parent.name:\"conhost.exe\" and not process.name:(\"mscorsvw.exe\", \"wermgr.exe\", \"WerFault.exe\", \"WerFaultSecure.exe\"))\n )\n",
"references": [
"https://github.com/sbousseaden/Slides/blob/master/Hunting MindMaps/PNG/Windows Processes TH.map.png",
"https://github.com/sbousseaden/Slides/blob/master/Hunting MindMaps/PNG/Windows Processes%20TH.map.png",
"https://www.andreafortuna.org/2017/06/15/standard-windows-processes-a-brief-reference/"
],
"risk_score": 47,
Expand Down Expand Up @@ -53,5 +53,5 @@
],
"timestamp_override": "event.ingested",
"type": "eql",
"version": 8
"version": 9
}